mirror of
https://gitlab.com/cryptsetup/cryptsetup.git
synced 2025-12-19 14:50:09 +01:00
c0cef43a4e
If configured with --disable-cryptsetup (e.g. if only veritysetup is required), these tests won't be able to run cryptsetup, so they need to be skipped.
197 lines
7.1 KiB
Bash
Executable File
197 lines
7.1 KiB
Bash
Executable File
#!/bin/bash
|
|
|
|
# check bitlk images parsing
|
|
|
|
[ -z "$CRYPTSETUP_PATH" ] && CRYPTSETUP_PATH=".."
|
|
CRYPTSETUP=$CRYPTSETUP_PATH/cryptsetup
|
|
TST_DIR=bitlk-images
|
|
MAP=bitlktst
|
|
DUMP_MK_FILE=bitlk-test-mk
|
|
|
|
CRYPTSETUP_VALGRIND=../.libs/cryptsetup
|
|
CRYPTSETUP_LIB_VALGRIND=../.libs
|
|
|
|
[ -z "$srcdir" ] && srcdir="."
|
|
|
|
function remove_mapping()
|
|
{
|
|
[ -b /dev/mapper/$MAP ] && dmsetup remove --retry $MAP
|
|
rm -rf $TST_DIR
|
|
}
|
|
|
|
function fail()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
echo " [FAILED]"
|
|
echo "FAILED backtrace:"
|
|
while caller $frame; do ((frame++)); done
|
|
remove_mapping
|
|
exit 2
|
|
}
|
|
|
|
function skip()
|
|
{
|
|
[ -n "$1" ] && echo "$1"
|
|
echo "Test skipped."
|
|
remove_mapping
|
|
exit 77
|
|
}
|
|
|
|
function load_vars()
|
|
{
|
|
local file=$(echo $1 | sed -e s/^$TST_DIR\\/// | sed -e s/\.img$//)
|
|
source <(grep = <(grep -A8 "\[$file\]" $TST_DIR/images.conf))
|
|
}
|
|
|
|
function check_dump()
|
|
{
|
|
dump=$1
|
|
file=$2
|
|
|
|
# load variables for this image from config file
|
|
load_vars $file
|
|
|
|
# description
|
|
dump_desc=$(echo "$dump" | grep Description: | cut -d: -f2 | tr -d "\t\n ")
|
|
[ "${dump_desc:0:7}" = "DESKTOP" -o "${dump_desc:0:3}" = "WIN" ] || fail " Description check from dump failed."
|
|
|
|
# GUID
|
|
dump_guid=$(echo "$dump" | grep Version -A 1 | tail -1 | cut -d: -f2 | tr -d "\t\n ")
|
|
[ ! -z "$GUID" -a "$dump_guid" = "$GUID" ] || fail " GUID check from dump failed."
|
|
|
|
# cipher
|
|
dump_cipher=$(echo "$dump" | grep "Cipher name" | cut -d: -f2 | tr -d "\t\n ")
|
|
dump_mode=$(echo "$dump" | grep "Cipher mode" | cut -d: -f2 | tr -d "\t\n ")
|
|
cipher=$(echo "$dump_cipher-$dump_mode")
|
|
[ ! -z "$CIPHER" -a "$cipher" = "$CIPHER" ] || fail " cipher check from dump failed."
|
|
|
|
if echo "$file" | grep -q -e "smart-card"; then
|
|
# smart card protected VMK GUID
|
|
dump_sc_vmk=$(echo "$dump" | grep "VMK protected with smart card" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
|
|
[ ! -z "$SC_VMK_GUID" -a "$dump_sc_vmk" = "$SC_VMK_GUID" ] || fail " smart card protected VMK GUID check from dump failed."
|
|
elif echo "$file" | grep -q -e "startup-key"; then
|
|
# startup key protected VMK GUID
|
|
dump_sk_vmk=$(echo "$dump" | grep "VMK protected with startup key" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
|
|
[ ! -z "$SK_VMK_GUID" -a "$dump_sk_vmk" = "$SK_VMK_GUID" ] || fail " startup key protected VMK GUID check from dump failed."
|
|
else
|
|
# password protected VMK GUID
|
|
dump_pw_vmk=$(echo "$dump" | grep "VMK protected with passphrase" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
|
|
[ ! -z "$PW_VMK_GUID" -a "$dump_pw_vmk" = "$PW_VMK_GUID" ] || fail " password protected VMK GUID check from dump failed."
|
|
fi
|
|
|
|
# recovery password protected VMK GUID
|
|
dump_rp_vmk=$(echo "$dump" | grep "VMK protected with recovery passphrase" -B 1 | head -1 | cut -d: -f2 | tr -d "\t ")
|
|
[ ! -z "$RP_VMK_GUID" -a "$dump_rp_vmk" = "$RP_VMK_GUID" ] || fail " recovery password protected VMK GUID check from dump failed."
|
|
|
|
}
|
|
|
|
function valgrind_setup()
|
|
{
|
|
command -v valgrind >/dev/null || fail "Cannot find valgrind."
|
|
[ ! -f $CRYPTSETUP_VALGRIND ] && fail "Unable to get location of cryptsetup executable."
|
|
export LD_LIBRARY_PATH="$CRYPTSETUP_LIB_VALGRIND:$LD_LIBRARY_PATH"
|
|
}
|
|
|
|
function valgrind_run()
|
|
{
|
|
INFOSTRING="$(basename ${BASH_SOURCE[1]})-line-${BASH_LINENO[0]}" ./valg.sh ${CRYPTSETUP_VALGRIND} "$@"
|
|
}
|
|
|
|
export LANG=C
|
|
[ ! -x "$CRYPTSETUP" ] && skip "Cannot find $CRYPTSETUP, test skipped."
|
|
[ ! -d $TST_DIR ] && tar xJSf $srcdir/bitlk-images.tar.xz --no-same-owner 2>/dev/null || skip "Incompatible tar."
|
|
|
|
[ -n "$VALG" ] && valgrind_setup && CRYPTSETUP=valgrind_run
|
|
|
|
echo "HEADER CHECK"
|
|
for file in $(ls $TST_DIR/bitlk-*) ; do
|
|
echo -n " $file"
|
|
out=$($CRYPTSETUP bitlkDump $file)
|
|
check_dump "$out" "$file"
|
|
echo " [OK]"
|
|
done
|
|
|
|
if [ $(id -u) != 0 ]; then
|
|
echo "WARNING: You must be root to run activation part of test, test skipped."
|
|
remove_mapping
|
|
exit 0
|
|
fi
|
|
|
|
echo "ACTIVATION FS UUID CHECK"
|
|
for file in $(ls $TST_DIR/bitlk-*) ; do
|
|
# load variables for this image from config file
|
|
load_vars $file
|
|
|
|
# test with both passphrase and recovery passphrase
|
|
for PASSPHRASE in $PW $RP ; do
|
|
echo -n " $file"
|
|
echo $PASSPHRASE | $CRYPTSETUP bitlkOpen -r $file --test-passphrase >/dev/null 2>&1
|
|
ret=$?
|
|
[ $ret -eq 1 ] && echo " [N/A]" && continue
|
|
echo $PASSPHRASE | $CRYPTSETUP bitlkOpen -r $file $MAP >/dev/null 2>&1
|
|
ret=$?
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc-elephant" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "clearkey" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "eow" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "-4k.img" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 0 ] || fail " failed to open $file ($ret)"
|
|
$CRYPTSETUP status $MAP >/dev/null || fail
|
|
$CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
|
|
uuid=$(lsblk -n -o UUID /dev/mapper/$MAP)
|
|
sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
|
|
$CRYPTSETUP remove $MAP || fail
|
|
[ "$uuid" = "$UUID" ] || fail " UUID check failed."
|
|
[ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
|
|
echo " [OK]"
|
|
done
|
|
|
|
# test with master key
|
|
rm -f $DUMP_MK_FILE >/dev/null 2>&1
|
|
echo -n " $file"
|
|
echo $PASSPHRASE | $CRYPTSETUP bitlkDump -r $file --dump-master-key --master-key-file $DUMP_MK_FILE >/dev/null 2>&1
|
|
ret=$?
|
|
[ $ret -eq 0 ] || fail " failed to dump master key"
|
|
$CRYPTSETUP bitlkOpen -r $file $MAP --master-key-file $DUMP_MK_FILE >/dev/null 2>&1
|
|
ret=$?
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "aes-cbc-elephant" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "clearkey" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "eow" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 1 ] && ( echo "$file" | grep -q -e "-4k.img" ) && echo " [N/A]" && continue
|
|
[ $ret -eq 0 ] || fail " failed to open $file using master key ($ret)"
|
|
$CRYPTSETUP status $MAP >/dev/null || fail
|
|
$CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
|
|
uuid=$(lsblk -n -o UUID /dev/mapper/$MAP)
|
|
sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
|
|
$CRYPTSETUP remove $MAP || fail
|
|
[ "$uuid" = "$UUID" ] || fail " UUID check failed."
|
|
[ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
|
|
echo " [OK]"
|
|
rm -f $DUMP_MK_FILE >/dev/null 2>&1
|
|
|
|
# startup key test -- we need to use BEK file from the archive
|
|
if echo "$file" | grep -q -e "startup-key"; then
|
|
echo -n " $file"
|
|
bek_file=$(echo $SK_VMK_GUID.BEK | tr /a-z/ /A-Z/)
|
|
$CRYPTSETUP bitlkOpen -r $file --test-passphrase --key-file $TST_DIR/$bek_file
|
|
ret=$?
|
|
[ $ret -eq 1 ] && echo " [N/A]" && continue
|
|
$CRYPTSETUP bitlkOpen -r $file $MAP --key-file $TST_DIR/$bek_file >/dev/null 2>&1
|
|
ret=$?
|
|
[ $ret -eq 0 ] || fail " failed to open $file ($ret)"
|
|
$CRYPTSETUP status $MAP >/dev/null || fail
|
|
$CRYPTSETUP status /dev/mapper/$MAP >/dev/null || fail
|
|
uuid=$(lsblk -n -o UUID /dev/mapper/$MAP)
|
|
sha256sum=$(sha256sum /dev/mapper/$MAP | cut -d" " -f1)
|
|
$CRYPTSETUP remove $MAP || fail
|
|
[ "$uuid" = "$UUID" ] || fail " UUID check failed."
|
|
[ "$sha256sum" = "$SHA256SUM" ] || fail " SHA256 sum check failed."
|
|
echo " [OK]"
|
|
|
|
fi
|
|
done
|
|
|
|
remove_mapping
|
|
exit 0
|